Enforcing restrictions related to a virtualized computer environment

Patent metadata

Field	Value
Publication number	US-9390286-B2
Application number	US-201414340506-A
Country	US
Kind code	B2
Filing date	Jul 24, 2014
Priority date	Sep 19, 2005
Publication date	Jul 12, 2016
Grant date	Jul 12, 2016

Abstract

An administrator may set restrictions related to the operation of a virtual machine (VM), and virtualization software enforces such restrictions. There may be restrictions related to the general use of the VM, such as who may use the VM, when the VM may be used, and on what physical computers the VM may be used. There may be similar restrictions related to a general ability to modify a VM, such as who may modify the VM. There may also be restrictions related to what modifications may be made to a VM, such as whether the VM may be modified to enable access to various devices or other resources. There may also be restrictions related to how the VM may be used and what may be done with the VM. Information related to the VM and any restrictions placed on the operation of the VM may be encrypted to inhibit a user from circumventing the restrictions.

First claim

What is claimed is:

1. A method for enforcing restrictions on a virtual machine (VM), said method comprising:
executing the VM on a physical computer, the VM configured to give a user access to guest software on the VM, the VM being executed using virtualization software and a virtual disk for storing data accessible to the guest software;
determining when an action violates one or more restrictions, the action relating to operation of the VM, the one or more restrictions being defined by contents of a policy file;
enforcing the one or more restrictions using enforcer software that is executing on the physical computer on which the VM runs, but is not executing within any VM on the physical computer, by intercepting the action relating to operation of the VM that violates the one or more restrictions and restricting the action relating to the operation of the VM that violates the one or more restrictions.

2. The method of claim 1 , wherein the VM is configured based on a configuration file containing configuration information defining virtual system hardware to emulate for the VM.

3. The method of claim 2 , wherein the VM is configured to enable the user to modify configuration settings for the VM, the modifying of the configuration settings including modifying contents of the configuration file; and
wherein at least one of the one or more restrictions is a restriction on the modifying of the configuration file.

4. The method of claim 2 , further comprising:
encrypting data written to the configuration file such that the user does not have direct access to the configuration file.

5. The method of claim 1 , wherein at least one of the one or more restrictions is a network restriction that limits access to predefined IP addresses on a TCP/IP network, the network restriction being enforced by intercepting and scanning outgoing TCP/IP packets to determine whether the TCP/IP packets violate the network restriction by being addressed to the predefined IP addresses;
wherein TCP/IP packets that do not violate the network restriction are allowed to be passed on to a physical network interface card (NIC) to be transmitted; and
wherein the TCP/IP packets that violate the network restriction are not allowed to be passed on to the physical NIC.

6. The method of claim 1 , wherein at least one of the one or more restrictions is an expiration date restriction that sets an expiration date beyond which the VM is prevented from being run; and
wherein the VM is prevented from being executed when a current date is past the expiration date.

7. The method of claim 1 , wherein at least one of the one or more restrictions is a machine restriction that permits the VM to execute only on one or more specified physical computer systems; and
wherein the VM is prevented from being executed if the physical computer is not one of the specified physical computer systems.

8. A computing system, comprising:
at least one physical processor; and
memory including instructions that, when executed by the at least one processor, cause the computing system to:
execute a virtual machine (VM) on a physical computer, which physical computer is part of the computing system, the VM configured to give a user access to guest software on the VM, the VM being executed using virtualization software and a virtual disk for storing data accessible to the guest software;
determine when an action violates one or more restrictions, the action relating to operation of the VM, the one or more restrictions being defined by contents of a policy file;
enforce the one or more restrictions using enforcer software that is executing on the physical computer on which the VM runs, but is not executing within any VM on the physical computer, by intercepting the action relating to operation of the VM that violates the one or more restrictions and restricting the action relating to the operation of the VM that violates the one or more restrictions.

9. The computing system of claim 8 , wherein the VM is configured based on a configuration file containing configuration information defining virtual system hardware to emulate for the VM.

10. The computing system of claim 9 , wherein the VM is configured to enable the user to modify configuration settings for the VM, the modifying of the configuration settings including modifying contents of the configuration file; and
wherein at least one of the one or more restrictions is a restriction on the modifying of the configuration file.

11. The computing system of claim 9 , wherein the memory further includes instructions that when executed by the at least one processor, cause the computing device to:
encrypt data written to the configuration file such that the user does not have direct access to the configuration file.

12. The computing system of claim 8 , wherein at least one of the one or more restrictions is a network restriction that limits access to predefined IP addresses on a TCP/IP network, the network restriction being enforced by intercepting and scanning outgoing TCP/IP packets to determine whether the TCP/IP packets violate the network restriction by being addressed to the predefined IP addresses;
wherein TCP/IP packets that do not violate the network restriction are allowed to be passed on to a physical network interface card (NIC) to be transmitted; and
wherein the TCP/IP packets that violate the network restriction are not allowed to be passed on to the physical NIC.

13. The computing system of claim 8 , wherein at least one of the one or more restrictions is an expiration date restriction that sets an expiration date beyond which the VM is prevented from being run; and
wherein the VM is prevented from being executed when a current date is past the expiration date.

14. The computing system of claim 8 , wherein at least one of the one or more restrictions is a machine restriction that permits the VM to execute only on one or more specified physical computer systems; and
wherein the VM is prevented from being executed if the physical computer is not one of the specified physical computer systems.

15. A non-transitory computer readable storage medium comprising one or more sequences of instructions, the instructions when executed by one or more processors of one or more physical computers causing the one or more processors to execute the operations of:
executing a virtual machine (VM) on a first physical computer of the one or more physical computers, the VM configured to give a user access to guest software on the VM, the VM being executed using virtualization software and a virtual disk for storing data accessible to the guest software;
determining when an action violates one or more restrictions, the action relating to operation of the VM, the one or more restrictions being defined by contents of a policy file;
enforcing the one or more restrictions using enforcer software that is executing on the first physical computer, but is not executing within any VM on the first physical computer, by intercepting the action relating to operation of the VM that violates the one or more restrictions and restricting the action relating to the operation of the VM that violates the one or more restrictions.

16. The non-transitory computer readable storage medium of claim 15 , wherein the VM is configured based on a configuration file containing configuration information defining virtual system hardware to emulate for the VM.

17. The non-transitory computer readable storage medium of claim 16 , wherein the VM is configured to enable the user to modify configuration settings for the

Assignees

• Vmware Inc

Inventors

• Ginzton Matthew David
• Eccleston Matthew B
• Krishnamurti Srinivas
• Chen Gerald C
• Ryan Nick Michael

Classifications

• H04L63/0236

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title

• G06F12/1408

  by using cryptography (for digital transmission H04L9/00) · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• G06F21/6281 Primary

  at program execution time, where the protection is within the operating system · CPC title

• G06F2221/2107

  File encryption · CPC title